CVE-2025-58034

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

CVSS 3.1

7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

55% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-25)

CISA KEV

listed 2025-11-18, due 2025-11-25

CWE

CWE-78

Published

2025-11-18

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• fortinet:fortiweb

References

• https://fortiguard.fortinet.com/psirt/FG-IR-25-513
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-58034

Check your stackJSON